cve-2008-4359
Vulnerability from cvelistv5
Published
2008-10-03 17:18
Modified
2024-08-07 10:17
Severity ?
Summary
lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.
References
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlThird Party Advisory
cve@mitre.orghttp://openwall.com/lists/oss-security/2008/09/30/1Mailing List
cve@mitre.orghttp://openwall.com/lists/oss-security/2008/09/30/2Mailing List
cve@mitre.orghttp://openwall.com/lists/oss-security/2008/09/30/3Mailing List
cve@mitre.orghttp://secunia.com/advisories/32069Third Party Advisory
cve@mitre.orghttp://secunia.com/advisories/32132Third Party Advisory
cve@mitre.orghttp://secunia.com/advisories/32480Third Party Advisory
cve@mitre.orghttp://secunia.com/advisories/32834Third Party Advisory
cve@mitre.orghttp://secunia.com/advisories/32972Third Party Advisory
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200812-04.xmlThird Party Advisory
cve@mitre.orghttp://trac.lighttpd.net/trac/changeset/2278Broken Link, Vendor Advisory
cve@mitre.orghttp://trac.lighttpd.net/trac/changeset/2307Broken Link, Vendor Advisory
cve@mitre.orghttp://trac.lighttpd.net/trac/changeset/2309Broken Link, Vendor Advisory
cve@mitre.orghttp://trac.lighttpd.net/trac/changeset/2310Broken Link, Vendor Advisory
cve@mitre.orghttp://trac.lighttpd.net/trac/ticket/1720Vendor Advisory
cve@mitre.orghttp://wiki.rpath.com/Advisories:rPSA-2008-0309Third Party Advisory
cve@mitre.orghttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309Third Party Advisory
cve@mitre.orghttp://www.debian.org/security/2008/dsa-1645Third Party Advisory
cve@mitre.orghttp://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patchPatch, Vendor Advisory
cve@mitre.orghttp://www.lighttpd.net/security/lighttpd_sa_2008_05.txtVendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/497932/100/0/threadedThird Party Advisory, VDB Entry
cve@mitre.orghttp://www.securityfocus.com/bid/31599Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2741Third Party Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/45690Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2008/09/30/1Mailing List
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2008/09/30/2Mailing List
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2008/09/30/3Mailing List
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32069Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32132Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32480Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32834Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32972Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200812-04.xmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://trac.lighttpd.net/trac/changeset/2278Broken Link, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://trac.lighttpd.net/trac/changeset/2307Broken Link, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://trac.lighttpd.net/trac/changeset/2309Broken Link, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://trac.lighttpd.net/trac/changeset/2310Broken Link, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://trac.lighttpd.net/trac/ticket/1720Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://wiki.rpath.com/Advisories:rPSA-2008-0309Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2008/dsa-1645Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patchPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.lighttpd.net/security/lighttpd_sa_2008_05.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/497932/100/0/threadedThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/31599Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2741Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/45690Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:17:08.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "32069",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32069"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.lighttpd.net/trac/changeset/2307"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt"
          },
          {
            "name": "32972",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32972"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.lighttpd.net/trac/changeset/2278"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0309"
          },
          {
            "name": "31599",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31599"
          },
          {
            "name": "32834",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32834"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.lighttpd.net/trac/ticket/1720"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.lighttpd.net/trac/changeset/2309"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309"
          },
          {
            "name": "32132",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32132"
          },
          {
            "name": "[oss-security] 20080930 Re: CVE request: lighttpd issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2008/09/30/1"
          },
          {
            "name": "20081030 rPSA-2008-0309-1 lighttpd",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/497932/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://trac.lighttpd.net/trac/changeset/2310"
          },
          {
            "name": "ADV-2008-2741",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2741"
          },
          {
            "name": "DSA-1645",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1645"
          },
          {
            "name": "[oss-security] 20080930 Re: Re: CVE request: lighttpd issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2008/09/30/3"
          },
          {
            "name": "lighttpd-urlredirect-rewrite-info-disclosure(45690)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45690"
          },
          {
            "name": "[oss-security] 20080930 Re: CVE request: lighttpd issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2008/09/30/2"
          },
          {
            "name": "32480",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32480"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch"
          },
          {
            "name": "SUSE-SR:2008:026",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
          },
          {
            "name": "GLSA-200812-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200812-04.xml"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-09-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "32069",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32069"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.lighttpd.net/trac/changeset/2307"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt"
        },
        {
          "name": "32972",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32972"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.lighttpd.net/trac/changeset/2278"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0309"
        },
        {
          "name": "31599",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31599"
        },
        {
          "name": "32834",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32834"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.lighttpd.net/trac/ticket/1720"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.lighttpd.net/trac/changeset/2309"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309"
        },
        {
          "name": "32132",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32132"
        },
        {
          "name": "[oss-security] 20080930 Re: CVE request: lighttpd issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2008/09/30/1"
        },
        {
          "name": "20081030 rPSA-2008-0309-1 lighttpd",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/497932/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://trac.lighttpd.net/trac/changeset/2310"
        },
        {
          "name": "ADV-2008-2741",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2741"
        },
        {
          "name": "DSA-1645",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1645"
        },
        {
          "name": "[oss-security] 20080930 Re: Re: CVE request: lighttpd issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2008/09/30/3"
        },
        {
          "name": "lighttpd-urlredirect-rewrite-info-disclosure(45690)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45690"
        },
        {
          "name": "[oss-security] 20080930 Re: CVE request: lighttpd issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2008/09/30/2"
        },
        {
          "name": "32480",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32480"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch"
        },
        {
          "name": "SUSE-SR:2008:026",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
        },
        {
          "name": "GLSA-200812-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200812-04.xml"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-4359",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "32069",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32069"
            },
            {
              "name": "http://trac.lighttpd.net/trac/changeset/2307",
              "refsource": "CONFIRM",
              "url": "http://trac.lighttpd.net/trac/changeset/2307"
            },
            {
              "name": "http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt",
              "refsource": "CONFIRM",
              "url": "http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt"
            },
            {
              "name": "32972",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32972"
            },
            {
              "name": "http://trac.lighttpd.net/trac/changeset/2278",
              "refsource": "CONFIRM",
              "url": "http://trac.lighttpd.net/trac/changeset/2278"
            },
            {
              "name": "http://wiki.rpath.com/Advisories:rPSA-2008-0309",
              "refsource": "CONFIRM",
              "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0309"
            },
            {
              "name": "31599",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31599"
            },
            {
              "name": "32834",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32834"
            },
            {
              "name": "http://trac.lighttpd.net/trac/ticket/1720",
              "refsource": "CONFIRM",
              "url": "http://trac.lighttpd.net/trac/ticket/1720"
            },
            {
              "name": "http://trac.lighttpd.net/trac/changeset/2309",
              "refsource": "CONFIRM",
              "url": "http://trac.lighttpd.net/trac/changeset/2309"
            },
            {
              "name": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309",
              "refsource": "CONFIRM",
              "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309"
            },
            {
              "name": "32132",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32132"
            },
            {
              "name": "[oss-security] 20080930 Re: CVE request: lighttpd issues",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2008/09/30/1"
            },
            {
              "name": "20081030 rPSA-2008-0309-1 lighttpd",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/497932/100/0/threaded"
            },
            {
              "name": "http://trac.lighttpd.net/trac/changeset/2310",
              "refsource": "CONFIRM",
              "url": "http://trac.lighttpd.net/trac/changeset/2310"
            },
            {
              "name": "ADV-2008-2741",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2741"
            },
            {
              "name": "DSA-1645",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1645"
            },
            {
              "name": "[oss-security] 20080930 Re: Re: CVE request: lighttpd issues",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2008/09/30/3"
            },
            {
              "name": "lighttpd-urlredirect-rewrite-info-disclosure(45690)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45690"
            },
            {
              "name": "[oss-security] 20080930 Re: CVE request: lighttpd issues",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2008/09/30/2"
            },
            {
              "name": "32480",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32480"
            },
            {
              "name": "http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch",
              "refsource": "CONFIRM",
              "url": "http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch"
            },
            {
              "name": "SUSE-SR:2008:026",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
            },
            {
              "name": "GLSA-200812-04",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200812-04.xml"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-4359",
    "datePublished": "2008-10-03T17:18:00",
    "dateReserved": "2008-09-30T00:00:00",
    "dateUpdated": "2024-08-07T10:17:08.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.4.20\", \"matchCriteriaId\": \"26A3F66A-350C-4592-9E11-855B5DFAE013\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0F92AB32-E7DE-43F4-B877-1F41FA162EC7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.\"}, {\"lang\": \"es\", \"value\": \"lighttpd versiones anteriores a v1.4.20 compara URIs con patrones en los ajustes de configuraci\\u00f3n (1) url.redirect y (2) url.rewrite antes de realizar la decodificaci\\u00f3n de URL, lo cual puede permitir a atacantes remotos evitar restricciones de acceso intencionado, y obtener informaci\\u00f3n sensible o posiblemente modificar datos.\"}]",
      "id": "CVE-2008-4359",
      "lastModified": "2024-11-21T00:51:29.550",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": true, \"userInteractionRequired\": false}]}",
      "published": "2008-10-03T17:41:40.430",
      "references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2008/09/30/1\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2008/09/30/2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2008/09/30/3\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://secunia.com/advisories/32069\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32132\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32480\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32834\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32972\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://security.gentoo.org/glsa/glsa-200812-04.xml\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2278\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2307\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2309\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2310\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/ticket/1720\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://wiki.rpath.com/Advisories:rPSA-2008-0309\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2008/dsa-1645\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/archive/1/497932/100/0/threaded\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securityfocus.com/bid/31599\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2741\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/45690\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2008/09/30/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2008/09/30/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://openwall.com/lists/oss-security/2008/09/30/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://secunia.com/advisories/32069\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32132\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32480\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32834\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/32972\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://security.gentoo.org/glsa/glsa-200812-04.xml\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2278\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2307\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2309\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/changeset/2310\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"http://trac.lighttpd.net/trac/ticket/1720\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://wiki.rpath.com/Advisories:rPSA-2008-0309\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2008/dsa-1645\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/archive/1/497932/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securityfocus.com/bid/31599\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2741\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/45690\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-4359\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-10-03T17:41:40.430\",\"lastModified\":\"2024-11-21T00:51:29.550\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL decoding, which might allow remote attackers to bypass intended access restrictions, and obtain sensitive information or possibly modify data.\"},{\"lang\":\"es\",\"value\":\"lighttpd versiones anteriores a v1.4.20 compara URIs con patrones en los ajustes de configuraci\u00f3n (1) url.redirect y (2) url.rewrite antes de realizar la decodificaci\u00f3n de URL, lo cual puede permitir a atacantes remotos evitar restricciones de acceso intencionado, y obtener informaci\u00f3n sensible o posiblemente modificar datos.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.20\",\"matchCriteriaId\":\"26A3F66A-350C-4592-9E11-855B5DFAE013\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F92AB32-E7DE-43F4-B877-1F41FA162EC7\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://openwall.com/lists/oss-security/2008/09/30/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://openwall.com/lists/oss-security/2008/09/30/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://openwall.com/lists/oss-security/2008/09/30/3\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://secunia.com/advisories/32069\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32132\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32480\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32834\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32972\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200812-04.xml\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2278\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2307\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2309\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2310\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/ticket/1720\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://wiki.rpath.com/Advisories:rPSA-2008-0309\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2008/dsa-1645\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/497932/100/0/threaded\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/31599\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.vupen.com/english/advisories/2008/2741\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/45690\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://openwall.com/lists/oss-security/2008/09/30/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://openwall.com/lists/oss-security/2008/09/30/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://openwall.com/lists/oss-security/2008/09/30/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://secunia.com/advisories/32069\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32132\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32480\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32834\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/32972\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200812-04.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2278\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2307\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/changeset/2310\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"http://trac.lighttpd.net/trac/ticket/1720\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://wiki.rpath.com/Advisories:rPSA-2008-0309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2008/dsa-1645\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.lighttpd.net/security/lighttpd-1.4.x_rewrite_redirect_decode_url.patch\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/497932/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/31599\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.vupen.com/english/advisories/2008/2741\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/45690\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.